Deployment Architecture

Deployment Monitor best practices

mundus
Path Finder

I'm getting some weird behavior with the Deployment monitor app. I've got two servers in our DMZ that act receive data from forwarders at another data center.

When I look at the "All Forwarders" tab, it shows one of the DMZ hosts twice, but not the other one. When I do a check from the command line from a host in the remote data center, it shows that forwarding is working properly.

So, my question is, why is one host showing up twice and not the other? I've confirmed that they have different hostnames defined in inputs.conf and server.conf. The other question is, do I need to run the Deployment Monitor on all forwarders? If not, then why can I only see the two forwarders that are forwarding directly to the central server and not any of the 3rd tier servers?

Thx.

Craig

0 Karma

araitz
Splunk Employee
Splunk Employee

This is pretty strange behavior, and I don't think I can diagnose it without taking a look at your enviroment. Can you please open a support case?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...